Back to results
US 11,310,262 B1Granted
Real-time vulnerability monitoring
AssigneeSecurity Profiling, LLC
InventorsBrett M. Oliphant, John P. Blignaut
Life of this patent
Estimating the term…
Abstract
An apparatus is provided including at least one platform; an intrusion prevention system configured to communicative couple with the at least one platform; a firewall configured to communicative couple with the at least one platform; at least one first data storage configured to communicative couple with the at least one platform; and at least one second data storage configured to communicative couple with the at least one platform. The at least one platform is configured to perform a plurality of operations that collective protect one or more networked devices.
Claims20
A method, comprising:
- at at least one component:
- causing addition of a first device of a plurality of devices to a first group of devices, where each device in the first group includes a first operating system and a first application;
- causing, before the first group of devices is attacked, addition of at least one first group policy to the first group of devices that causes at least one update to a first virus scanner and a first intrusion detection system installed on the first device, the at least one first group policy including, at least in part, a first already-existent policy;
- causing editing of the at least one first group policy;
- in response to a first attack being detected and prevented at the first device utilizing at least one of the first virus scanner or the first intrusion detection system, causing, in response to an administrator action, an administrator function that is different from and in addition to the prevention of the first attack;
- utilizing group management signals, causing performance of group management operations, the group management signals including at least five (5) of:
- a first group management signal for causing performance of a first group management operation to create a particular group,
- a second group management signal for causing performance of a second group management operation to retrieve a list of a plurality of different groups,
- a third group management signal for causing performance of a third group management operation to retrieve group information associated with at least one of the plurality of different groups,
- a fourth group management signal for causing performance of a fourth group management operation to delete at least one of the plurality of different groups,
- a fifth group management signal for causing performance of a fifth group management operation to edit at least one of the plurality of different groups,
- a sixth group management signal for causing performance of a sixth group management operation to add at least one group policy to at least one of the plurality of different groups,
- a seventh group management signal for causing performance of a seventh group management operation to edit the at least one group policy,
- an eighth group management signal for causing performance of an eighth group management operation to delete the at least one group policy, and
- a ninth group management signal for causing performance of a ninth group management operation to retrieve the at least one group policy;
- at at least one server:
- supporting deployment of a first client agent to the first group of devices for installing the first client agent on the first group of devices;
- causing sending, from the at least one server to the first device over at least one network, a first product upgrade to upgrade the first client agent and at least one of the first virus scanner, the first intrusion detection system, or a first firewall;
- in response to receiving a first one of a plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a first one of a plurality of first device-related server signals for being processed at the first device to apply the at least one first group policy at the first device;
- based on the first operating system, causing identification of a plurality of first device vulnerabilities including at least one first device vulnerability of the first operating system;
- in response to receiving a second one of the plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a second one of the plurality of first device-related server signals including first device vulnerability information to provide an update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the at least one first group policy, the second one of the plurality of first device-related server signals including the first device vulnerability information corresponding with the first device vulnerabilities;
- receiving updated first device vulnerability information from at least one other server;
- in response to receiving a third one of the plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a third one of the plurality of first device-related server signals including the updated first device vulnerability information to provide another update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the at least one first group policy;
- in response to receiving a fourth one of the plurality of first device signals and based on the editing the at least one first group policy, causing sending, from the at least one server to the first device over the at least one network, a fourth one of the plurality of first device-related server signals for being processed at the first device to apply the edited at least one first group policy at the first device;
- in response to receiving a fifth one of the plurality of first device signals and based on the editing the at least one first group policy, causing sending, from the at least one server to the first device over the at least one network, a fifth one of the plurality of first device-related server signals to provide yet another update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the edited at least one first group policy;
- and
- in response to receiving a sixth one of the plurality of first device signals, causing reporting of an application of the at least one first group policy at the first device;
- in response to receiving a seventh one of the plurality of first device signals, causing reporting of an application of the edited at least one first group policy at the first device;
- in response to receiving an eighth one of the plurality of first device signals, causing reporting of an installation of the yet another update at the first device;
- and
- at the first device with the first client agent, the first virus scanner, and the first intrusion detection system installed on the first device:
- receiving, at the first device from the at least one server over the at least one network, the first product upgrade to upgrade the first client agent and at least one of the first virus scanner, the first intrusion detection system, or the first firewall;
- causing sending, from the first device to the at least one server over the at least one network, the first one of the plurality of first device signals;
- after sending the first one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the first one of the plurality of first device-related server signals;
- in response to receiving the first one of the plurality of first device-related server signals, causing processing of the first one of the plurality of first device-related server signals to apply the at least one first group policy at the first device, based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices;
- causing sending, from the first device to the at least one server over the at least one network, the second one of the plurality of first device signals;
- after sending the second one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the second one of the plurality of first device-related server signals including the first device vulnerability information to provide the update for use at the first device in accordance with the at least one first group policy;
- in response to receiving the second one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the update for use at the first device in accordance with the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the third one of the plurality of first device signals;
- after sending the third one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the third one of the plurality of first device-related server signals including the updated first device vulnerability information to provide the another update for use at the first device in accordance with the at least one first group policy;
- in response to receiving the third one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the another update for use at the first device in accordance with the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the fourth one of the plurality of first device signals;
- after sending the fourth one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the fourth one of the plurality of first device-related server signals;
- in response to receiving the fourth one of the plurality of first device-related server signals, causing processing of the fourth one of the plurality of first device-related server signals to apply the edited at least one first group policy at the first device, based on the editing the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the fifth one of the plurality of first device signals;
- after sending the fifth one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the fifth one of the plurality of first device-related server signals to provide the yet another update for use at the first device in accordance with the edited at least one first group policy;
- in response to receiving the fifth one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the yet another update for use at the first device in accordance with the edited at least one first group policy;
- identifying, utilizing the first client agent, the application of the at least one first group policy at the first device;
- causing, utilizing the first client agent, sending, from the first device to the at least one server over the at least one network, the sixth one of the plurality of first device signals, for causing reporting of the application of the at least one first group policy at the first device;
- identifying, utilizing the first client agent, the application of the edited at least one first group policy at the first device;
- causing, utilizing the first client agent, sending, from the first device to the at least one server over the at least one network, the seventh one of the plurality of first device signals, for causing reporting of the application of the edited at least one first group policy at the first device;
- identifying, utilizing the first client agent, the yet another update for use at the first device in accordance with the edited at least one first group policy;
- causing, utilizing the first client agent, sending, from the first device to the at least one server over the at least one network, the eighth one of the plurality of first device signals, for causing reporting of the installation of the yet another update for use at the first device;
- causing, utilizing the first client agent, identification of a first portion of the first device vulnerability information that includes virus scanner-related information that corresponds with at least one of the first device vulnerabilities;
- causing, utilizing the first client agent, identification of a second portion of the first device vulnerability information that includes intrusion-related information that corresponds with at least one of the first device vulnerabilities;
- causing identification of a first network traffic event in connection with the first device;
- in response to identifying the first network traffic event, causing, utilizing the first intrusion detection system installed on the first device, a determination whether the at least one of the first device vulnerabilities corresponding with the intrusion-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device, utilizing the intrusion-related information of the first device vulnerability information, access to which is provided at the first device utilizing the first client agent;
- in response to identifying the first network traffic event, causing, utilizing the first virus scanner installed on the first device, a determination whether the at least one of the first device vulnerabilities corresponding with the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device, utilizing the virus scanner-related information of the first device vulnerability information, access to which is provided at the first device utilizing the first client agent;
- identifying a determination that the at least one of the first device vulnerabilities corresponding with at least one of the intrusion-related information or the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device;
- and
- in response to the identification of the determination that the at least one of the first device vulnerabilities corresponding with at least one of the intrusion-related information or the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device:
- detecting the first network traffic event as the first attack,
- causing prevention of the first attack, and
- causing, utilizing the first client agent, sending, from the first device over the at least one network, a first incident signal for reporting the first attack.
61 more elements
A non-transitory computer readable storage medium storing one or more programs for at least one component, a first device, and at least one server in communication via at least one network, the one or more programs comprising instructions which, when executed by at least one of:
- the at least one component, the first device, or the at least one server, cause a plurality of actions including:
- causing addition of a first device of a plurality of devices to a first group of devices, where each device in the first group includes a first operating system and a first application;
- causing, before the first group of devices is attacked, addition of at least one first group policy to the first group of devices that causes at least one update to a first virus scanner and a first intrusion detection system installed on the first device;
- causing editing of the at least one first group policy;
- in response to a first attack being detected and prevented at the first device utilizing at least one of the first virus scanner or the first intrusion detection system, causing, in response to an administrator action, an administrator function that is different from and in addition to the prevention of the first attack;
- utilizing group management signals, causing performance of group management operations, the group management signals including at least five (5) of:
- a first group management signal for causing performance of a first group management operation to create a particular group,
- a second group management signal for causing performance of a second group management operation to retrieve a list of a plurality of different groups,
- a third group management signal for causing performance of a third group management operation to retrieve group information associated with at least one of the plurality of different groups,
- a fourth group management signal for causing performance of a fourth group management operation to delete at least one of the plurality of different groups,
- a fifth group management signal for causing performance of a fifth group management operation to edit at least one of the plurality of different groups, a sixth group management signal for causing performance of a sixth group management operation to add at least one group policy to at least one of the plurality of different groups,
- a seventh group management signal for causing performance of a seventh group management operation to edit the at least one group policy,
- an eighth group management signal for causing performance of an eighth group management operation to delete the at least one group policy, and
- a ninth group management signal for causing performance of a ninth group management operation to retrieve the at least one group policy;
- supporting deployment of a first client agent to the first group of devices for installing the first client agent on the first group of devices;
- causing sending, from the at least one server to the first device over the at least one network, a first product upgrade to upgrade the first client agent and at least one of the first virus scanner, the first intrusion detection system, or a first firewall;
- in response to receiving a first one of a plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a first one of a plurality of first device-related server signals for being processed at the first device to apply the at least one first group policy at the first device;
- based on the first operating system, causing identification of a plurality of first device vulnerabilities including at least one first device vulnerability of the first operating system;
- in response to receiving a second one of the plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a second one of the plurality of first device-related server signals including first device vulnerability information to provide an update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the at least one first group policy, the second one of the plurality of first device-related server signals including the first device vulnerability information corresponding with the first device vulnerabilities;
- receiving updated first device vulnerability information from at least one other server;
- in response to receiving a third one of the plurality of first device signals and based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices, causing sending, from the at least one server to the first device over the at least one network, a third one of the plurality of first device-related server signals including the updated first device vulnerability information to provide another update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the at least one first group policy;
- in response to receiving a fourth one of the plurality of first device signals and based on the editing the at least one first group policy, causing sending, from the at least one server to the first device over the at least one network, a fourth one of the plurality of first device-related server signals for being processed at the first device to apply the edited at least one first group policy at the first device;
- in response to receiving a fifth one of the plurality of first device signals and based on the editing the at least one first group policy, causing sending, from the at least one server to the first device over the at least one network, a fifth one of the plurality of first device-related server signals to provide yet another update to be caused to be installed on the first device utilizing the first client agent for use at the first device in accordance with the edited at least one first group policy;
- receiving, at the first device from the at least one server over the at least one network, the first product upgrade to upgrade the first client agent and at least one of the first virus scanner, the first intrusion detection system, or the first firewall;
- causing sending, from the first device to the at least one server over the at least one network, the first one of the plurality of first device signals;
- after sending the first one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the first one of the plurality of first device-related server signals;
- in response to receiving the first one of the plurality of first device-related server signals, causing processing of the first one of the plurality of first device-related server signals to apply the at least one first group policy at the first device, based on the addition of the at least one first group policy to the first group of devices and the addition of the first device to the first group of devices;
- causing sending, from the first device to the at least one server over the at least one network, the second one of the plurality of first device signals;
- after sending the second one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the second one of the plurality of first device-related server signals including the first device vulnerability information to provide the update for use at the first device in accordance with the at least one first group policy;
- in response to receiving the second one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the update for use at the first device in accordance with the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the third one of the plurality of first device signals;
- after sending the third one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the third one of the plurality of first device-related server signals including the updated first device vulnerability information to provide the another update for use at the first device in accordance with the at least one first group policy;
- in response to receiving the third one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the another update for use at the first device in accordance with the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the fourth one of the plurality of first device signals;
- after sending the fourth one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the fourth one of the plurality of first device-related server signals;
- in response to receiving the fourth one of the plurality of first device-related server signals, causing processing of the fourth one of the plurality of first device-related server signals to apply the edited at least one first group policy at the first device, based on the editing the at least one first group policy;
- causing sending, from the first device to the at least one server over the at least one network, the fifth one of the plurality of first device signals;
- after sending the fifth one of the plurality of first device signals, receiving, at the first device from the at least one server over the at least one network, the fifth one of the plurality of first device-related server signals to provide the yet another update for use at the first device in accordance with the edited at least one first group policy;
- in response to receiving the fifth one of the plurality of first device-related server signals, causing, utilizing the first client agent, installation of the yet another update for use at the first device in accordance with the edited at least one first group policy;
- causing, utilizing the first client agent, identification of a first portion of the first device vulnerability information that includes virus scanner-related information that corresponds with at least one of the first device vulnerabilities;
- causing, utilizing the first client agent, identification of a second portion of the first device vulnerability information that includes intrusion-related information that corresponds with at least one of the first device vulnerabilities;
- causing identification of a first network traffic event in connection with the first device;
- in response to identifying the first network traffic event, causing, utilizing the first intrusion detection system installed on the first device, a determination whether the at least one of the first device vulnerabilities corresponding with the intrusion-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device, utilizing the intrusion-related information of the first device vulnerability information;
- in response to identifying the first network traffic event, causing, utilizing the first virus scanner installed on the first device, a determination whether the at least one of the first device vulnerabilities corresponding with the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device, utilizing the virus scanner-related information of the first device vulnerability information;
- identifying a determination that the at least one of the first device vulnerabilities corresponding with at least one of the intrusion-related information or the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device;
- and
- in response to the identification of the determination that the at least one of the first device vulnerabilities corresponding with at least one of the intrusion-related information or the virus scanner-related information of the first device vulnerability information is susceptible to being taken advantage of by the first network traffic event identified in connection with the first device:
- detecting the first network traffic event as the first attack,
- causing prevention of the first attack, and
- causing, utilizing the first client agent, sending, from the first device over the at least one network, a first incident signal for reporting the first attack.
47 more elements
Dependencies are inferred from the claim text.